5.5
Medium
CVE-2023-2422 A flaw was found in Keycloak
Description
A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Single Sign-On 7 | Versions not published | |
| Red Hat Single Sign-On 7.6 for RHEL 7 | Versions not published | |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Versions not published | |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Versions not published | |
| RHEL-8 based Middleware Containers 7.6 | earliest → < 7.6-24 | 7.6-24 |
References
- RHSA-2023:3883 access.redhat.com
- RHSA-2023:3884 access.redhat.com
- RHSA-2023:3885 access.redhat.com
- RHSA-2023:3888 access.redhat.com
- RHSA-2023:3892 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2191668 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Single Sign-On 7
The 294 CVEs of Red Hat Single Sign-On 7 →
CVE-2026-97848
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
6.5
Medium
CVE-2026-97367
Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
6.4
Medium
CVE-2026-96547
Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
6.5
Medium
CVE-2026-96460
Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2
5.4
Medium